Im trying to "grasp" how a user should authenticate to our API. Our API is setup to use OpenID Connect thats issued by an ADFS-server. However.. as a "consumer" of our application, whould one expect there to be an endpoint for requesting an access-token? Or should we simply not provide an endpoint for that, and "expect" (with some instructions to our users) that the user requests an access token directly from the ADFS-server?.. whats the common pattern/flow? Since both our API and the ADFS-server is connected to the same domain, we are currently using Single sign on (not sure if that matters, but just providing that information in case it would).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy